sonarqube

Automatically enforce SonarQube code quality and security in the agent coding loop — 7,000+ rules, secrets scanning, agentic analysis, and quality gates across 40+ languages. PostToolUse hooks run analysis after every file edit. Pre-tool secrets scanning prevents 450+ patterns from reaching the LLM. Slash commands give on-demand access to quality gate status, coverage, duplication, and dependency risks. Includes SonarQube CLI, MCP Server, skills, hooks, and slash commands.

Install

If the official marketplace isn’t added yet, run

Category: Security
Author: SonarSource
GitHub: SonarSource/sonarqube-agent-plugins
Website: sonarsource.com

Good for

Run SonarQube quality and security analysis after every file edit
Scan for 450+ secret patterns before they reach the LLM
Check quality gate status, coverage, duplication and dependency risks with slash commands
Ask to analyze code for issues or show open SonarQube findings

Getting started

Run /plugin install sonarqube@claude-plugins-official
Run /sonarqube:sonar-integrate to install the CLI, log in, and wire up the MCP server and hooks
Use /sonarqube:sonar-quality-gate, or ask 'analyze my code for issues'

Before you install

Requires a SonarQube account (Cloud, Server or Community Build), the SonarQube CLI (sonar), a container runtime (Docker, Podman or Nerdctl) and Node.js. Some features depend on SonarQube Cloud organization settings.

Summarized by AI from the project docs; check the official docs before relying on it.

Similar tools

claude-securityOfficial plugin · Security
Deep vulnerability scanning of your own code, run entirely inside your Claude Code session at a chosen effort tier, with every finding challenged before it is reported and the verification tally computed in code. Turns surviving findings into targeted patches, each verified by a panel of agents, that you apply when you choose.
security-guidanceOfficial plugin · Security
Security review for Claude-generated code. Pattern-based warnings on edits, LLM-powered diff review on Stop, and an agentic commit reviewer that catches injection, XSS, SSRF, hardcoded secrets, and 25+ other vulnerability classes.
42crunch-api-security-testingOfficial plugin · Security
Automate API security directly in Claude Code with 42Crunch - automatically audit OpenAPI specs, detect vulnerabilities aligned with OWASP API Security risks (including BOLA/BFLA), and apply AI-powered fixes. Designed for AI-assisted development workflows, it provides continuous guardrails through an audit->scan->remediate->validate loop, ensuring APIs meet enterprise security standards before deployment.
auth0Official plugin · Security
Enterprise-grade auth, easy to implement. Add login, SSO, MFA, and access control to any app with framework-aware guidance.
crowdsecOfficial plugin · Security
Operational skill for installing, configuring, operating, and debugging CrowdSec (cscli, LAPI/CAPI, hub, bouncers, WAF/AppSec) across bare-metal, Docker, and Kubernetes.